Anti-bribery management system requirements
What the domain tests
Questions here target the mandatory “shall” requirements in ISO 37001 clauses 4–10: context and scope, leadership, planning, support, operation, performance evaluation and improvement. You must know what must be documented and what must actually be done.
Core requirements
- Context and scope (4): determine external and internal issues, interested parties, scope and ABMS boundaries; scope must be documented.
- Leadership (5): top management establishes the anti-bribery policy, ensures integration, resources and communication, and promotes a culture that discourages bribery. The anti-bribery compliance function must have direct access to top management and the governing body.
- Planning (6): bribery risk assessment identifies, analyses and evaluates risks; objectives are measurable, monitored and resourced.
- Support (7): competence, awareness, training, communication and documented information.
- Operation (8): due diligence on business associates; financial and non-financial controls; controls over gifts, hospitality, donations and benefits; managing inadequate controls; confidential raising of concerns; investigation and response.
- Performance evaluation (9): monitoring, internal audit and management review.
- Improvement (10): nonconformity, corrective action and continual improvement.
Worked example
An auditor finds that agents are due-diligenced only when contracts exceed USD 1 million. The organization’s risk assessment identifies small local agents as high risk. The threshold is not risk-based and leaves high-risk associates unchecked, so the auditor raises a nonconformity against due diligence requirements, citing the risk assessment and contract sample.
Traps
Assuming the compliance function, not top management, establishes the policy; treating a risk assessment as a one-off; confusing management review with internal audit; and accepting “we have a procedure” when there is no evidence of implementation.